With the remainder of the file being the real gif contents. I ran it in a VM
with a sniffer and
Procmon to see what it was doing, but that's not as good as seeing the code.
I asked around concerning what sort of encoding it was using, and folks pointed
me to the post at the SAN Internet Storm Center:

But that had few detail on how the encoding was done. Byte_Bucket from
Pauldotcom pointed me at a tool called "Windows
Script Encoder" from Microsoft that seems to be what was used. After doing
some checking, the encoded part of the JSE starts with #@~^ , which is also what
the MS tool creates.

Once I knew Windows Script Encoder was used, I Google around for a decoder. This
site: